Virtual APs with seperate DHCP servers error on 7.15.1

RouterOS Wireless Networking
1

I have a hAP ac3 that I’ve just upgraded to 7.15.1 from 7.12.1. It has three virtual APs, and separate DHCP servers and address pools for each, ex: virtual AP virtap has it’s own /24 and uses DHCP server virtap from pool virtap, virtap2 has a different /24, server, and pool.

After upgrading to 7.15.1, I discovered that the DHCP server screen now has “DHCP server can not run on slave interface!” for the DHCP servers that were configured for the virtual APs:

[master@MikroTik] > ip dhcp print
Flags: I - INVALID
Columns: NAME, INTERFACE, ADDRESS-POOL, LEASE-TIME
#   NAME          INTERFACE  ADDRESS-POOL  LEASE-TIME
0   defconf       bridge     dhcp          8h        
;;; DHCP server can not run on slave interface!
1 I virtap2        VIRTAP2     virtap2        4h        
;;; DHCP server can not run on slave interface!
2 I virtap3       VIRTAP3    virtap3       12h       
;;; DHCP server can not run on slave interface!
3 I virtap         VIRTAP      virtap         30m

When tested the servers are working despite the error; new clients to the virtual APs are issued addresses from the correct pool, their leases show the correct server name, etc.

Looking at a config dump from before the upgrade:

/ip dhcp-server
add address-pool=virtap authoritative=yes bootp-support=none disabled=no \
    interface=VIRTAP lease-script="" lease-time=12h name=virtap \
    server-address=192.168.12.1 use-radius=no

was a valid command in 7.12.1. In 7.15.1 it returns the “can not run on slave interface” error.

How should I update the configuration to correct the error so I can perform future updates to the DHCP config?

2

This usually happens if such “slave interface” is made a bridge port. In this case bridge interface should be used as anchor interface for DHCP server.

3

Currently all wifi interfaces (real and virtualAP) are part of the same default bridge “bridge”, with the virtual APs as ports on it. But I’m not sure what you meant by using the bridge interface for the DHCP server? Trying to set the interface to “bridge” for the DHCP server returns an error since there’s already a DHCP server there.

4

AFAIK, you cannot have more than one DHCP server on a single L2 domain. What do you want to achieve?

5

Perhaps you should post full config (run /export file=anynameyouwish from terminal window, fetch the resulting file, open it with text editor, redact any remeining sensitive data such as public IP addresses or serial numbers, and copy-paste it inside [__code] [/code] tag pair). It does seem that there are some more errors in your config which affect the behaviour.

BTW, setting DHCP server (or any other L3 setup, such as IP address) on slave interface (which is bridge port) was always a wrong thing to do … it’s only recent versions of ROS that highlight this fact to users. Behaviour was always on the edge of erratic though.

6

To maintain my current setup, with three virtual APs, each running a DHCP server that hands out addresses from a IP pool dedicated to that virtual AP. (ex: 192.168.12.0/24 for virtual AP 1, 192.168.14.0/24 for virtual AP 2, etc). That’s the setup I’ve been using for years and have had no issues with. Indeed, it’s working fine right now - except I can’t edit or update the DHCP server config anymore as it has suddenly decided it is invalid (but working!)

7
8

OK, so according to configuration all the VIRTAP interfaces should be off-bridge (and thus “eligible” for L3 setup). But you should check if this is indeed so:

/interface/bridge/port/print

should not show them listed.

9

Indeed, the virtualAP interfaces are NOT part of the default bridge. Is maybe a bug in the check they apparently recently added?

10

I suggest you to open a ticket with support@mikrotik.com … provide them with suppout.rif file, it should become clear pretty quickly.

11

I am not the OP :slight_smile: , but I agree.

12

They are present, but show as (D)ynamic:

Flags: I - INACTIVE; D - DYNAMIC; H - HW-OFFLOAD
Columns: INTERFACE, BRIDGE, HW, PVID, PRIORITY, PATH-COST, INTERNAL-PATH-COST, HORIZON
#     INTERFACE  BRIDGE  HW   PVID  PRIORITY  PATH-COST  INTERNAL-PATH-COST  HORIZON
;;; defconf
0 I H ether2     bridge  yes     1  0x80             10                  10  none   
;;; defconf
1   H ether3     bridge  yes     1  0x80             10                  10  none   
;;; defconf
2 I H ether4     bridge  yes     1  0x80             10                  10  none   
;;; defconf
3   H ether5     bridge  yes     1  0x80             10                  10  none   
;;; defconf
4     wifi1      bridge          1  0x80             10                  10  none   
;;; defconf
5     wifi2      bridge          1  0x80             10                  10  none   
6  D  VIRTAP1    bridge          1  0x80                                     none   
7  D  VIRTAP2    bridge          1  0x80                                     none   
8  D  VIRTAP3    bridge          1  0x80                                     none
13

Are they maybe “inheriting” the datapath.bridge property of the master interface? Can you try to unset that property?

14

It does look to be defaulting to that:

[master@MikroTik] > /interface/bridge/port/print detail
Flags: X - disabled, I - inactive; D - dynamic; H - hw-offload
<...>
 7  D  interface=VIRTAP2 bridge=bridge priority=0x80 edge=auto point-to-point=no learn=auto horizon=none auto-isolate=no restricted-role=no restricted-tcn=no pvid=1 
       frame-types=admit-all ingress-filtering=yes unknown-unicast-flood=yes unknown-multicast-flood=yes broadcast-flood=yes tag-stacking=no bpdu-guard=no trusted=no 
       mvrp-registrar-state=normal mvrp-applicant-state=normal-participant multicast-router=temporary-query fast-leave=no

But it won’t allow me to unset it:

[master@MikroTik] > /interface/bridge/port/unset 7
value-name: bridge
Script Error: action cancelled

I’m wondering if I need to create separate bridges for each virtualAP now? Later edit, that doesn’t work either. Trying to remove the virtualAP from the default bridge through webfig gives an error “can not remove dynamic port (6)”. Trying to edit the bridge port through /interface/bridge/port/edit doesn’t return an error but the change is ignored and it stays bridge=bridge.

15

You have to set bridge property in datapath configuration of slave wireless interface to an appropriate setting.

The manual says the following about it:

Bridge interface to add interface to, as a bridge port.
Virtual (‘slave’) interfaces are by default added to the same bridge, if any, as the corresponding master interface. Master interfaces are not by default added to any bridge.

It doesn’t seem it’s possible to unset the value for virtual interfaces. But what does happen if one tries to set it to inexistent bridge? Does it fail to bring interface up? Or does it get added to master’s bridge? Or it remains unconnected (just like @OP wants it to be)?

16

I would entirely skip the datapath property. You are already manually adding the master interfaces to the bridge. I think that’s suffice. The slave interfaces will not be part of the bridge.

17

I am using a dedicated VLAN for each AP/SSID to achieve the same results.
Works with Wifi and wireless (new wifi on ac3 with manual VLAN setup on bridge an qcom-ac drivers)…with or without capsman.

18

Tried the datapath option, but it won’t accept setting an empty bridge for the virtAP interface. Opened a ticket with Mikrotik support last week, but no replies so far. May have to try reworking around the dedicated VLAN per virtAP method Hominidae suggested, pointers to good docs on that would be appreciated!

19

Have you tried to not set the datapath property?

20

Did you read my previous reply? Virtual (slave) wifi interfaces inherit datapath from master if not set explicitly.